Vulnerability in /public/wp-includes/sodium_compat/composer.json.

[artsiomreutovich]

Please check GH report regarding vulnerable package

Overview
A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details
Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern
if ($buffer !== false) {

Unsafe call without restrictions
$coverage = @unserialize($buffer);

}
The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

[johnbillion]

@artsiomreutovich When you submitted this report why did you ignore the warning telling you not to publicly submit a security vulnerability report here?

I presume you're actually referring to ​https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p which is a vulnerability in PHPUnit that your AI-assisted or automated scanning tool has picked up due to the dependencies in composer.json for sodium_compat.

Please be significantly more careful in the future, especially when you use AI or automated tools to generate bug reports or report security vulnerabilities: ​https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/.